<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
    <head>
        <title>CruiseControl.NET : Security Extension Points</title>
	    <link rel="stylesheet" href="styles/site.css" type="text/css" />
        <META http-equiv="Content-Type" content="text/html; charset=UTF-8">	    
    </head>

    <body>
	    <table class="pagecontent" border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="#ffffff">
		    <tr>
			    <td valign="top" class="pagebody">
				    <div class="pageheader">
					    <span class="pagetitle">
                            CruiseControl.NET : Security Extension Points
                                                    </span>
				    </div>
				    <div class="pagesubheading">
					    This page last changed on Jun 29, 2009 by <font color="#0050B2">csut017</font>.
				    </div>

				    <h3><a name="SecurityExtensionPoints-SecurityExtensionPoints"></a>Security Extension Points</h3>

<p>Nearly every item in security can be extended or replaced. This page will cover some of the key points for extending security.</p>

<h4><a name="SecurityExtensionPoints-ServerExtensions"></a>Server Extensions</h4>

<p>Security at the server level implements <font color="Blue"><tt>ISecurityManager</tt></font>. This interface handles the core functionality of security including:</p>
<ul>
	<li>Logging on/off</li>
	<li>Session management</li>
	<li>Retrieving users and permissions</li>
	<li>Checking permissions</li>
	<li>Logging audit events</li>
	<li>Retrieving audit events</li>
	<li>Password management</li>
</ul>


<p>Most of the time, these are passed onto other interfaces that implement the actual functionality. However this interface acts as the co-ordinator for all this functionality.</p>

<p>Rather than completely implementing this functionality from scratch, there is an abstract base class which provides a basic implementation of most of this functionality. This class is called <font color="Blue"><tt>SecurityManagerBase</tt></font>. This class implements session management, audit logging and reading and authentication. This functionality is provided through implementations of the other security interfaces.</p>

<h4><a name="SecurityExtensionPoints-ProjectExtensions"></a>Project Extensions</h4>

<p>Security at the project level implements <font color="Blue"><tt>IProjectAuthorisation</tt></font>. This interface implements checking permissions at the project level.</p>

<p>The default implementation of this class will hand over permission checking to an implementation of <font color="Blue"><tt>IPermission</tt></font> (assuming there is a valid permission for the user.)</p>

<h4><a name="SecurityExtensionPoints-Permissions"></a>Permissions</h4>

<p>All permissions implement <font color="Blue"><tt>IPermission</tt></font>. This interface exposes two methods:</p>
<ul>
	<li>CheckUser(): this will check to see whether the permission is valid for the current user.</li>
	<li>CheckPermission(): this performs the actual check to return the permission (e.g. Allow, Deny, Inherit).</li>
</ul>



				    
                    			    </td>
		    </tr>
	    </table>
	    <table border="0" cellpadding="0" cellspacing="0" width="100%">
			<tr>
				<td height="12" background="http://confluence.public.thoughtworks.org//images/border/border_bottom.gif"><img src="images/border/spacer.gif" width="1" height="1" border="0"/></td>
			</tr>
		    <tr>
			    <td align="center"><font color="grey">Document generated by Confluence on Sep 29, 2009 20:59</font></td>
		    </tr>
	    </table>
    </body>
</html>